GHSA-9wx4-h78v-vm56 CVE-2024-35195 PYSEC-2026-1873

Requests `Session` object does not verify requests after making first request with verify=False

Medium PyPI

Severity: 5.6 / 10; Medium · CVSS 3.1
Exploit chance (EPSS): 0.34%; Chance of exploitation in the next 30 days. Higher than 27.51% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-670 Always-Incorrect Control Flow Implementation
Fix: 2.32.0; Upgrade requests to this version or later

Description

When using a requests.Session, if the first request to a given origin is made with verify=False, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if verify=True is explicitly specified later.

This occurs because the underlying connection is reused from the session's connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.

This behavior affects versions of requests prior to 2.32.0.

Affected versions

PyPI

Package	Vulnerable	Fixed in
requests	`< 2.32.0`	`2.32.0`
requests	`< 2.32.0`	`2.32.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

requests PyPI → `2.32.0`

pip

pip install --upgrade "requests>=2.32.0"

poetry

poetry add "requests>=2.32.0"

uv

uv add "requests>=2.32.0"

Severity breakdown

CVSS 3.1 5.6

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Attack vector: Local
Attack complexity: High
Privileges required: High
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

Weakness

CWE-670: Always-Incorrect Control Flow Implementation

The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

References

Advisories

Fixes and patches

Packages

Timeline

May 20, 2024 Published
Sep 10, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-gc5v-m9x4-r6x2 Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function	Medium	Also affects requests
GHSA-9hjg-9r4m-mvj7 Requests vulnerable to .netrc credentials leak via malicious URLs	Medium	Also affects requests
GHSA-j8r2-6x86-q33q Unintended leak of Proxy-Authorization header in requests	Medium	Also affects requests
GHSA-x84v-xcm2-53pg Insufficiently Protected Credentials in Requests	High	Also affects requests
GHSA-pg2w-x9wp-vw92 Python Requests Session Fixation	Medium	Also affects requests
GHSA-cfj3-7x9c-4p3h Exposure of Sensitive Information to an Unauthorized Actor in Requests	Medium	Also affects requests
GHSA-652x-xj99-gmcc Exposure of Sensitive Information to an Unauthorized Actor in Requests	Medium	Also affects requests
GHSA-vg88-3v92-rjx2 Vyper: Return inside for loop more than 1 level deep	Low	Same weakness, CWE-670

Credits: liiiiiiaduarte34-art, mikeassel, nateprewitt, sigmavirus24

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor